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^ecoinme.tsof^ea|^Ucant.elowa.eachpreccdedbyr.latedc^^^^ 
examiner (in small, bold type). 

nurlHM) as currently awumdedwhentt appears no 
cinT«ction Is required. 

aaim 6 has been amended. 

5. ciaim40reiected«nder35U5.C.m(e)a.belng«.tleipatedbytyU^ 

Patent No. 6386402. 

As per claim 40: 

. ^i^^^««dlM4reiected under 35 U.S.C. 103(a) as being 

LyiB, VS. patent No. 6^86,102- 

Ag per dain 1: . 

flmctiiHis 88 the anomaly). , ^ the home location an anomaly based on 

Shostack fails to teach Jj transndtting notice of the 

»nttotl«»homoloc»tionliromatl««tOMOto(*<J«^^ 

^maly to the dient location at which suspected attack, is determined 

a method wherdn an jjtent, ^^^^^^^^ J^^^'^efa »!K :52-7. 18). Lyle also dsdoses 

rx-d^sTt^"-^^^^ 

BU^ected attack (8:21-59). 
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but lacks the featmes recited in claim 40. 

Asper claim 41 : , . ^ 

home location wWch is the local server); ^ (7:37-63; 9;10-2l, 

ftmctions as the suttomaly). ^ , ♦ *Kia knnift locatioii an anomaly based on the possibla 

S«S2{ tor apartlcular ffle type ttiociatedvlthakiiowii 
Intnuion teclmiqne (10;44-59). 

p,«i^irf^in»e»»a»ly.a»p»dcd.rtef^ 

ZI^9).Se6o»na.di»Io.ecr»^se»M™toa-«™*.dd«»P<e^^ 
as a security problem. 
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Asptf claim42: 

location which Is the local server); ^„„i ^mp the client location (7:57-63; 9:10-21, 

that have occimrcd (7:SM;11) • 

Moran, us. PatentNo. 6,826,fi97. 

if ^loSilte teach a ixiethod In wMch datcrmtaiag the anomaly ««prbes 
Shostack and Lyle an w ■ ». ... , i»«tn rmm an nnenwcted user. Howeiver, 
searching for noa^ndard access patterns such wa^^^ 

UencUieaainj^hodwhere^^^^^ 
obvloas to one of ordtoa^s^ ir^th^^^^^ 

inventloas «f *™l^y^^^^Vh! !^ detect further types of attacks such as forward 

Increase the security against attacks as a whole. 

Moran does not disclose or suggest "searching for an unexpected login," as recited in 
am^ed claim 42. 

Tb^ "login- recited in claim 42 is a successM login, not a foiled login. By contrast, 
Moran discloses logging of '^ed" login atten«>ts. Moran does not disclose or suggest 
searching for an uneacpected login. 

AU of the dependent claims are patentable for at least the same reasons as the claims on 

which they depend- 

Caii»ledoUim.ifany,ha«bemoaiceledwilhoulpr<3«dto 

Any drc»m».ancc in «U* the appta«t I»« add««ed wriam 
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tiiereaxenototh^goodreasonsforpatentabmtyoflhoseclaiins and Other cl^^^ 
ci^um^ceinwHchtheappUcanth^sam^dedorcanceledaclaim^^ 
^pUcantconcedes«.yofti,e— r'spositio^s^th^tothatcl^^ 

Pleaseapplyanychargesorc«ditstodepodtaccount06-10S0,refe^ 

10559-463001. 
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